Cookie settings

Choose which cookies we can use. You can change this at any time from “Cookie settings” in the footer. See our cookie policy for details.

Essential

Needed for the site to work, such as remembering your cookie choices. These can’t be switched off.

Always on

Help us understand which pages are visited and how people find us (Google Analytics). Off unless you turn it on.

Skip to content
New in 3.4.0 8 new features and 16 fixes November special 20% off every Pro plan with code NOVEMBER20 Black Friday 50% off every Pro plan until Sunday 29 November
WP Extended Modular WordPress toolkit , home
Docs Security & Privacy Free

Disable XML-RPC documentation

Switch off xmlrpc.php, the old remote publishing endpoint that attackers use to try many passwords in a single request.

About Disable XML-RPC

Overview

XML-RPC predates the REST API and most sites no longer need it. It still accepts login attempts, often outside the limits a login plugin sets on wp-login.php.

Plan: Free. Everything on this page is in the free plugin.

Setup

  1. Go to WP Extended in your WordPress admin and find Disable XML-RPC under Security & Privacy.
  2. Switch Disable XML-RPC on.
  3. There is nothing to configure. The module works as soon as it is on.

Questions and troubleshooting

Is Disable XML-RPC free?

Yes. It is in the free plugin.

Will this break anything?

Only tools that still use XML-RPC, such as some older remote publishing apps and certain Jetpack features. Check before enabling it on a site that uses them.

It isn’t working as expected

Check the module is switched on and its settings are saved. If another plugin does the same job, deactivate one of them. Then clear any page cache and test again. Still stuck? Pro customers can contact support; free users can post on the WordPress.org forum.